Minutes of the meeting of the Audit and Compliance Committee of the Board of Directors of the Cook County 
Health and Hospitals System held Friday, December 11, 2009 at the hour of 10:00 A.M., at John H. Stroger, Jr. 
Hospital of Cook County, 1901 W. Harrison Street, in the fifth floor conference room, Chicago, Illinois. 


I. Attendance/Call to Order 


Chairman Munoz called the meeting to order. 

Present: Chairman Luis Munoz, MD, MPH and Director Benn Greenspan, PhD, MPH, FACHE (2) 
Board Chairman Warren L. Batts (Ex-Officio) and Director Quin R. Golden 


Absent: Director Heather O’Donnell, JD, LLM (1) 


Additional attendees and/or presenters were: 


Michael Ayres 
Cathy Bodnar 
William T. Foley 
Tracy Guidry 
Patrick Hagan 


Tim Heinrich 
Randolph Johnston 
Pat Kitchen 
Elizabeth Reidy 
Deborah Santana 


Thomas Schroeder 
Anthony J. Tedeschi, MD, MPH, 
MBA 


II. Public Speakers 

Chairman Munoz asked the Secretary to call upon the registered speakers. 
The Secretary called upon the following registered speaker: 

1. George Blakemore Concerned Citizen 


III. Report from System Corporate Compliance Officer 

Cathy Bodner, System Coiporate Compliance Officer, presented a report (Attachment #1) that included 
information on the following: status report of 4 th quarter activity, revisiting the elements of a compliance 
program, general and specialty compliance - education and training activity, and activity on additional 
elements. 

During the discussion of education and training, Ms. Bodner noted that one important element that she found 
was missing is the compliance attestation. The attestation states that the individual will take the responsibility 
for completing the training, and attests that they will conform to the System’s standards of conduct. That will 
be completed now with new employee orientations, and also with annual orientations. She added that, in the 
future, this will be tracked electronically. 

On the subject of attestation, Director Greenspan inquired regarding the penalties for non-compliance. Ms. 
Bodnar responded that penalties have not yet been determined; discussions must be held with the Department of 
Human Resources on the subject. 

In response to a question from Chairman Munoz regarding electronic programs for corporate compliance 
training and tracking, Ms. Bodnar responded that she expects to bring in that resource in May 2010. This 
resource will do the training, attestation and tracking electronically. 

Director Greenspan referenced a subject that was recently discussed in the Finance Committee. This was 
regarding the System’s requirement, as set forth in the Procurement Policy, which directs the Purchasing 
Department to track ex parte communications. Further discussion took place regarding standards of conduct, 
future activities and areas to address. 
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IV, Report from System Director of Internal Audit 

A. Building an Internal Audit Function 

Thomas Schroeder, System Director of Internal Audit, presented a report on building an internal audit 
function (Attachment #2). The Committee reviewed and discussed the information. 

Chairman Munoz inquired regarding the estimated date of completion for the internal audit charter. Mr. 
Schroeder responded that he has drafted an internal audit charter; once the Audit and Compliance 
Committee charter is approved, the approval of the internal audit charter will follow. 

The Committee briefly discussed the 2010 budget for Internal Audit. Mr. Schroeder provided information 
on the subject. Chairman Munoz noted that a discussion should be held on the subject at the next Audit and 
Compliance Committee meeting, in order to ensure that there is budgetary support to be able to meet the 
expectations and goals set for 2010. 

V, Recommendations, Discussion/lnformation Items 

A. Minutes of the Audit and Compliance Committee Meeting, October 13, 2009, recessed and 
reconvened October 15, 2009 

Director Greenspan, seconded by Chairman Munoz, moved to accept the minutes of the Audit and 
Compliance Committee Meeting of October 13, 2009, recessed and reconvened October 15, 2009. THE 
MOTION CARRIED UNANIMOUSLY. 

B. Proposed Charter for the Audit and Compliance Committee of the CCHHS Board of Directors 

Ms. Bodnar and Mr. Schroeder introduced the draft charter to the Committee. Ms. Bodnar proposed that 
the members review this document and provide input, so that a final document can be presented for 
approval at the next Committee meeting. 

Director Greenspan made a suggestion for the Purpose section. Rather than limiting it to the financial 
integrity and controls system of financial reporting, there should be a statement in the Purpose section 
stating that the System’s goal is to establish an environment of integrity. 

C. Proposed System Corporate Compliance Program’s mission and vision statement 

Ms. Bodnar introduced the draft System Corporate Compliance Program’s mission and vision statement. 
After discussion, Chairman Munoz stated that the members should review this document and provide input, 
so that a final document can be presented for approval at the next Committee meeting. Ms. Bodnar noted 
that this draft includes input received from the ad hoc Work Group on Corporate Compliance. 

Director Greenspan stated that there is a perception of self-interest at many levels, rather than of public 
interest; one of the tasks of the Board is to overcome that perception. Therefore, there should be a positive 
statement included which states, for example, that the purpose of the Compliance Program is to support the 
mission of the System, and to establish the public’s interest as primary. 
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V, Recommendations, Discussion/Information Items (continued) 

D. Update from ad hoc Corporate Compliance Work Group 

i. Proposed Charter of Ad Hoc Work Group on Corporate Compliance 

Ms. Bodnar presented the proposed charter ( Attachment #3) of the ad hoc Work Group on Corporate 
Compliance, on behalf of Dr. Carolyn Lopez, who was unable to attend the meeting. The Committee 
reviewed and discussed the proposed charter. 

Director Greenspan, seconded by Chairman Munoz, moved the approval of the proposed Charter of the 
ad hoc Work Group on Corporate Compliance. THE MOTION CARRIED UNANIMOUSLY. 

E. Update from RSM McGladrey on status of internal audits 

Pat Kitchen and Tim Heinrich, of RSM McGladrey, presented an update on the status of the internal audits 
(Attachment #4). The Committee reviewed and discussed the information. 

Chairman Munoz requested additional information with regard to information technology security. Mr. 
Kitchen stated that the focus is really around the general security environment and controls around access; 
this is to ensure that both the physical access and the information security access is appropriately controlled. 
Mr. Heinrich noted that they are still in the process of testing; he provided additional information on the 
scope of the audit. 


F. Update from Deloitte & Touche on 2008 Audit 

Tracy Guidry, of Deloitte & Touche, presented an update on the 2008 Audit, which has now been 
completed. She stated that they are prepared to issue final financials next week. She stated the entire audit 
will be available on Tuesday, December 15 th . 

Ms. Guidry reminded the Committee that back in July, they were given a draft management letter for their 
review. There is another version of that letter now; it contains the same comments, however, it now 
includes management’s responses. 

Chairman Munoz requested that Ms. Guidry provide a brief summary of material weaknesses. Ms. Guidry 
stated that there is a repeat finding from the prior year; it relates to timeliness of financial reporting. 


VI. Action Items 


A. Any items listed under Section V 


Page 3 of 33 



Minutes of the Audit and Compliance Committee Meeting 

December 11, 2009 
Page 4 


VII. Adjourn 

As the agenda was exhausted. Chairman Munoz declared that the meeting was adjourned. 


Respectfully submitted, 

Audit and Compliance Committee of the 

Board of Directors of the 

Cook County Health and Hospitals System 


xxxxxxxxxxxxxxxxxxxxxx 

Luis Munoz, MD, MPH, Chairman 


Attest: 


XXXXXXXXXXXXXXXXXXXXXX 
Deborah Santana, Secretary 
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Corporate Compliance Report 


Presented To 

Cook County Health & Hospitals System 
Audit & Compliance Committee 

Cathy Bodnar, MS, RN, CHC 
Chief Compliance Officer 
December 11, 2009 
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Status Report of 

4 th Quarter 2009 Activity 

□ Assess each compliance program element 

♦ Status: Completed 

□ Engage audit & compliance committee 

♦ Status: Ongoing 

□ Charter an internal compliance committee 

♦ Status: In process - Anticipated completion date 1Q2010 

□ Redefine the role of the ad hoc committee 

♦ Status: Completed; Requesting approval later this meeting 

□ Develop FY2010 work plan 

♦ Status: In process - Anticipated completion date 1Q2010 

□ Establish and report compliance metrics 

Status: To be determined 
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Revisiting the Elements 
of a Compliance Program 

Recall the OIG guidance identified the following, 

□ Setting standards through written policies and procedures 

■ In process through external resources 
(5% complete) 

□ Communicating the standards through regular education 
and training programs 

■ In process and ongoing 
(10% complete) 
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General Compliance 
Education & Training Activity 


□ Updated new employee orientation module 

□ Updated annual employee orientation module 

□ Updated CCHHS Standards of Conduct 

■ Implemented at John H. Stroger Hospital 

■ Pending implementation at Oak Forest Hospital 

■ Planned introduction to the leadership at other entities 

□ Need for policies to this functionality - in process 

□ Evaluated external vendor capability for e-learning 

□ Engaged Ad Hoc Work Group to assist with assessment 

□ Identified need for an open market request for e-learning 

■ Goal to complete within January 2010 

□ On track for e-learning implementation 

■ Roll out planned for week of May 3, 2010 
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Initiation of Employee Attestation 




COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 

CC#fH5 


Annual Employee Certification 


Corporate Compliance 
& 


HPAA Training 


Name Date 

by placing your name and date on the line above, you certify and confirm that you have reviewed 
the material and completed the training and that you will comply with the CCHHS Standards of Conduct. 
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Specialty Compliance 
Education & Training Activity 

□ Senior Leadership 

■ Orientation to the OIG’s compliance program elements during a 
September leadership meeting 

□ Audit & Compliance Committee Education 

■ Orientation to the OIG’s compliance program elements at the 
October Audit & Compliance Committee meeting 

■ HCCA article “The Board of Director’s Role in Overseeing 
Compliance Effectiveness” distribution in October 

■ OIG & AHLA’s “Corporate Responsibility and Corporate Compliance: 
Resource for Health Care Boards of Directors” distribution in October 

■ Sponsored a webinar “Board of Director’s Oversight of Compliance 
Program Effectiveness” in October 

■ HCCA article" Roles and Responsibilities - Corporate Compliance 
and Internal Audit” 
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Activity on 
Additional Elements 


□ Providing a mechanism for reporting potential violations 

■ Vendor contract in review for telephonic and web hotline 

■ Policies to support this functionality - in process 
(50% complete) 

■ Develop a strategy to communicate the updated mechanisms 
(0% complete) 

□ Responding to and investigating the concerns raised 

■ Ongoing 

■ Developing Vendor contract in review for tracking tools 

■ Policies to support this functionality - in process 
(10% complete) 

□ Maintaining an organizational structure to sustain and 
enhance the program 

■ Ongoing 
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The Outstanding Elements 


□ Enforcing standards and disciplining actions that are non- 
compliant 

■ To Be Determined 

□ Utilizing monitoring and auditing activities to decrease problems 

■ To Be Determined 
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Building An Internal Audit Function 


Presentation To 

Cook County Health and Hospitals System 
Audit and Compliance Committee 


Tom Schroeder 
Director of Internal Audit 
December 11, 2009 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 

CC#f HS 
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Building an Internal Audit Function 


There are 10 steps to building an internal audit function O) 

1. Establish stakeholder expectations 

2. Develop Internal Audit mission statement 

3. Develop Internal Audit strategic plan 

4. Assess risk and develop internal audit plan 

5. Establish Internal Audit budgets 

6. Assess Internal Audit skill requirements 

7. Develop Internal Audit infrastructure 

8. Execute Internal Audit work 

9. Establish communication protocols 

10. Measure results 

( 1 ) Building a Strategic Internal Audit Function, 2005 PricewaterhouseCoopers. 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 

CC#f HS 
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1) Establish stakeholder expectations 


Inputs: 

□ Audit Committee 

□ Senior leaders 

□ Senior operating management 

Outputs: 

□ Articulated expectations 

□ Stakeholder buy-in 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 

CC#f HS 
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2) Develop Internal Audit Mission/Vision Statement 


Inputs: 

□ Audit Committee 

□ Senior leaders 

□ Senior operating management 

Outputs: 

□ Mission/Vision statement 

□ Audit/Compliance Committee Charter 

□ Internal Audit Charter 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 

CC#f HS 
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3) Develop Internal Audit Strategic Plan 


Inputs: 

□ Audit Committee 

□ Senior leaders 

□ Senior operating management 

□ Benchmarks/assumptions 

□ Entity strategic plan 

Outputs: 

□ Internal Audit value drivers/linkage to entity strategic plan 

□ Internal Audit resource requirements 

□ Implementation timeline 

□ Communication of Internal Audit strategic plan 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 

CC#f HS 
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4) Assess Risk and Develop Internal Audit Plan 


Inputs: 

□ Business processes 

□ Business objectives 

□ Definition of audit universe 

□ Stakeholder dialog 

Outputs: 

□ Risk assessment 

□ Audit plan 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 
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5) Establish Internal Audit Budgets 


Inputs: 

□ Stakeholder expectations 

□ Internal Audit mission statement 

□ Internal Audit strategic plan 

□ Risk assessment and internal audit plan 

Outputs: 

□ 3 year resource plan 
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& HOSPITALS SYSTEM 
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6) Assess Internal Audit Skill Set Requirements 


Inputs: 

□ Stakeholder expectations 

□ Internal Audit mission statement 

□ Internal Audit strategic plan 

□ Risk assessment and internal audit plan 

Outputs: 

□ Assessment of required resources, skills, competencies - 
current and future 

□ Job descriptions 

Preliminary Assessment of Team Needs: 

□ Director of Internal Audit 

□ Information Technology auditor (1) 

□ Financial Auditor - (1 or 2) 

□ Operational/Compliance auditor (1 or 2) 

□ Five total staff including Director 
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& HOSPITALS SYSTEM 
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7) Develop Internal Audit Infrastructure 


Inputs: 

□ Stakeholder expectations 

□ Internal Audit Mission Statement 

□ Internal Audit plan 

Outputs: 

□ Enabling technology (electronic work paper solution -RSMI Auditor 
Assistant; online resources - KnowledgeLeader.com ) 

□ Internal Audit methodologies 

□ Internal Audit policies and procedures 

□ Professional associations (e.g. Institute of Internal Auditors, 
ISACA, Association of Healthcare Internal Auditors) 

□ Benchmarking 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 

CC#fHS 
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8) Execute Internal Audit Work 


Inputs: 

□ RSMI resources 

□ Incremental additions of CCHHS in-house internal audit resources 
Outputs: 

□ Internal Audit reports 

□ Issues 

□ Solutions 

□ Follow up on issue resolution 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 

CCHHS 
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9) Establish Communication Protocols 


Inputs: 

□ Stakeholder expectations 

□ Internal Audit Mission Statement 


Outputs: 


□ Report timing, format, content 

□ Report distribution - senior management, line management; 
others? 

□ Progress reporting - audit status and outstanding issues 

□ Audit Committee reporting 

□ Formal vs. informal communications 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 
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10) Measure Results 


Inputs: 

□ Stakeholder expectations 

□ Internal Audit value drivers 

Outputs: 

□ Metrics (qualitative and quantitative) 

□ Balanced scorecard 



COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 
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Timeline 



Dec 

Jan 

Feb 

Mar 

Apr 

May 

Jun 

Stakeholder Expectations 


X 






IA Mission/Vision 


X 






Audit Committee Charter 


X 






Internal Audit Charter 



X 





Electronic Work Papers 

X 







Reporting 


X 

X 

X 

X 

X 

— 

Internal Audit Strategic Plan 



X 





Internal Audit Resource Plan 



X 





Online Resources 



X 





Professional Associations 



X 





Internal Audit Methodology 




X 




Internal Audit Policies and Procedures 




X 




Refresh Risk Assessment 




X 




Internal Audit Metrics and Scorecard 







X 
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COOK COUNTY HEALTH 
& HOSPITALS SYSTEM 


CC#fHS 


Date: December 11, 2009 

To: Chairman Luis Munoz, MD, MPH 

Director Benn Greenspan, PhD, MPH, FACHE 
Heather O’Donnell, JD, LLM 

From: Carolyn Lopez, MD 

Coordinator, Ad Hoc Work Group on Corporate Compliance 

Cathy Bodnar, MS, RN, CHC 
Chief Compliance Officer, CCHHS 

Subject: Proposal to Modify the Charge to Ad Hoc Work Group 


Background 

At the November 17, 2008 Audit and Compliance Committee of the Board of Directors 
of the Cook County Health and Hospitals System, discussion of the creation of an Ad 
Hoc Work Group on Corporate Compliance occurred. Once created, this group, 
coordinated by Dr. Carolyn Lopez and composed of Chicago area professionals that are 
either compliance program stakeholders or experts in corporate compliance, was charged 
with assisting, as needed, in the efforts to bring a Corporate Compliance Officer on board 
and developing the CCHHS compliance program structure and, once developed, create an 
implementation plan. The group, through the coordinator, would report to the Committee 
the work plan and progress of the work plan tasks. 

Original Charge 

In January 2009, the charge of the Ad Hoc Work Group was formalized. Details follow, 

■ To develop a corporate compliance plan for the Cook County Health and 
Hospitals System (CCHHS) that is current, comprehensive, relevant, and 
containing all the essential elements of a strong and effective plan. 

■ To create an implementation plan that will include 

- A plan for initial and follow-up training for all affected employees 

- A plan for monitoring and ensuring that all affected employees complete 
initial and follow-up training in a timely manner 

The Work Group shall function in partnership with CCHHS leaders and staff in 
completing its charge. 

Proposal 

In September 2009, CCHHS hired Cathy Bodnar as the Chief Compliance Officer. In 
light of this action, the Ad Hoc Work Group on Corporate Compliance and the Chief 
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Compliance Officer request the Audit and Compliance Committee thoughtfully consider 
the following proposal to modify the original charge. 

The Ad Hoc Work Group on Corporate Compliance is charged with providing direction 
to the system compliance program. Responsibilities include providing oversight on 
unrestricted compliance program activities; this includes, but is not limited to, guidance 
on the mission and vision of the compliance program, the CCHHS code of ethics/ 
standard of conduct, compliance communications, and education and training for the 
community in general along with Cook County Health & Hospitals System (CCHHS) 
personnel 1 . 

1 CCHHS personnel is defined as including officers, directors, members of 
committees with Board-delegated authority, employees, and members of the 
CCHHS medical staff or house staff, researchers, students and agency personnel. 
This would also apply to independent contractors, consultants and other business 
partners (vendors) who are not employees but are working at CCHHS. 


cc: William T. Foley, CEO, CCHHS 


Page 30 of 33 



Cook County Health and Hospitals System 
Minutes of the Audit and Compliance Committee Meeting 

December 11, 2009 


ATTACHMENT #4 


Page 31 of 33 



RSM McGladrey 


Memo 


To: 

Dr. Luis Munoz, Audit and Compliance Committee Chairman 
Cook County Health & Hospitals System 

From: 

RSM McGladrey Inc. 

Date: 

December 11,2009 

Subject: 

Internal Audit projects status update 


1. Reporting Period Covered 

August 1,2009, through December 31,2009 

2. RSM McGladrey Inc.'s Team 

• Pat Kitchen, Managing Director 

• Hussain Hasan, Managing Director 

• Scott Esgar, Director 

• Tim Heinrich, Director 

• Christina Ng-Tran, Manager 

• Lowell Smith, Manager 
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Update of MedAssets revenue cycle contract payment review 
ESI outpatient pharmacy contract reconciliation review 



























